Security Bulletin: IBM Security Access Manager 9.0.7.1 and IBM Security Verify Access 10.0.0.0 may be affected by the log4j vulnerability (CVE-2021-44228)

Summary The IBM Security Access Manager 9.0.7.1 and IBM Security Verify Access 10.0.0.0 product ships the One-time Password component which embeds a vulnerable version of the log4j library. This has been fixed in the latest supported versions of the product. Customers should move up to the latest...

Security Bulletin: Vulnerability in Apache Log4j (CVE-2021-4104) affects InfoSphere Data Replication

Summary There is a vulnerability in the version of Log4j that was included in InfoSphere Data Replication. Vulnerability Details CVEID: CVE-2021-4104 DESCRIPTION: Apache Log4j could allow a remote attacker to execute arbitrary code on the system, caused by the deserialization of untrusted data wh...

Security Bulletin: Oracle Database Server Vulnerability Affects IBM Emptoris Supplier Lifecycle Mgmt (CVE-2021-2335)

Summary An Oracle database server vulnerability was addressed in IBM Emptoris Supplier Lifecycle Management. Vulnerability Details CVEID: CVE-2021-2335 DESCRIPTION: An unspecified vulnerability in Oracle Database Server related to the Database - Enterprise Edition Data Redaction component could...

Security Bulletin: Oracle Database Server Vulnerability Affects IBM Emptoris Strategic Supply Management Platform (CVE-2021-2335)

Summary An Oracle database server vulnerability was addressed in IBM Emptoris Strategic Supply Management Platform. Vulnerability Details CVEID: CVE-2021-2335 DESCRIPTION: An unspecified vulnerability in Oracle Database Server related to the Database - Enterprise Edition Data Redaction component...

Security Bulletin: Oracle Database Server Vulnerability Affects IBM Emptoris Supplier Lifecycle Mgmt (CVE-2021-2336)

Summary An Oracle database server vulnerability was addressed in IBM Emptoris Supplier Lifecycle Management. Vulnerability Details CVEID: CVE-2021-2336 DESCRIPTION: An unspecified vulnerability in Oracle Database Server related to the Database - Enterprise Edition Data Redaction component could...

Microsoft Excel 2013 Service Pack 1 Multiple Vulnerabilities (KB5002105)

This host is missing an important security update according to Microsoft KB5002105 Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This...

actionpack Open Redirect in Host Authorization Middleware

Specially crafted "X-Forwarded-Host" headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. For example, configuration files...

GHSA-QPHC-HF5Q-V8FC actionpack Open Redirect in Host Authorization Middleware

Specially crafted "X-Forwarded-Host" headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. For example, configuration files...

KB5009301 - FIX: XSS attacks and open redirect vulnerability in the ESB.Portal sample application for Microsoft BizTalk ESB Toolkit

None None...

Description of the security update for SharePoint Enterprise Server 2013: December 14, 2021 (KB5002008)

None None...

Description of the security update for SharePoint Foundation 2013: December 14, 2021 (KB5002015)

Description of the security update for SharePoint Foundation 2013: December 14, 2021 KB5002015 Summary This security update resolves a Microsoft SharePoint Server remote code execution vulnerability. To learn more about the vulnerability, see Microsoft Common Vulnerabilities and Exposures...

Description of the security update for SharePoint Enterprise Server 2016: December 14, 2021 (KB5002055)

None None...

Description of the security update for SharePoint Enterprise Server 2016: December 14, 2021 (KB5002059)

None None...

Description of the security update for Office 2013: December 14, 2021 (KB5002104)

Description of the security update for Office 2013: December 14, 2021 KB5002104 Summary This security update resolves a Microsoft Jet Red database engine and access connectivity engine elevation of privilege vulnerability. To learn more about the vulnerability, see Microsoft Common Vulnerabilitie...

Description of the security update for Office 2013: December 14, 2021 (KB5002101)

Description of the security update for Office 2013: December 14, 2021 KB5002101 Summary This security update resolves a Microsoft Office trust center spoofing vulnerability. To learn more about the vulnerability, see Microsoft Common Vulnerabilities and Exposures CVE-2021-43255. Note: To apply th...

PT-2021-24124

Name of the Vulnerable Software and Affected Versions: Action Pack versions 6.0.0 and later Description: A vulnerability exists that could allow an attacker to craft X-Forwarded-Host headers in combination with certain allowed host formats, causing the Host Authorization middleware to redirect...

Possible Open Redirect in Host Authorization Middleware

There is a possible open redirect vulnerability in the Host Authorization middleware in Action Pack. Specially crafted "X-Forwarded-Host" headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect IBM Decision Optimization Center (CVE-2021-35586, CVE-2021-35578)

Summary There are multiple vulnerabilities in IBM® SDK Java™ and IBM® Runtime Environment Java™ Versions 7 & 8 used by IBM Decision Optimization Center. IBM Decision Optimization Center has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2021-35586 DESCRIPTION: An unspecified...

Security Bulletin: Multiple vulnerabilities in Apache Commons Compress affect IBM Tivoli Netcool Impact (CVE-2021-35517, CVE-2021-36090)

Summary Multiple vulnerabilities have been identified in the Apache Commons Compress shipped with IBM Websphere Liberty. IBM Websphere Liberty is shipped with IBM Tivoli Netcool/Impact. Vulnerability Details CVEID: CVE-2021-35517 DESCRIPTION: Apache Commons Compress is vulnerable to a denial of...

Security Bulletin: September 2021 : A vulnerability in IBM Java Runtime affects CICS Transaction Gateway

Summary A vulnerability exists in IBM® Runtime Environment Java™ Versions 7.0, 7.1 and 8.0 used by CICS Transaction Gateway. CICS Transaction Gateway has addressed this. Vulnerability Details CVEID: CVE-2021-2161 DESCRIPTION: An unspecified vulnerability in Java SE related to the Libraries...